https://vulnogram.org/ Most recent CVEs assigned by HiddenLayer, Inc. (hiddenlayer). https://vulnogram.org/seaview/icons/hiddenlayer.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-87988 https://vulnogram.org/CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active w… Critical Network Exploitable Fri, 11 Sep 2026 14:35:34 GMT https://vulnogram.org/CVE-2026-87987 https://vulnogram.org/CVE-2026-87987 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-… Critical Network Exploitable Fri, 11 Sep 2026 14:34:01 GMT https://vulnogram.org/CVE-2026-87986 https://vulnogram.org/CVE-2026-87986 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute… Critical Network Exploitable Fri, 11 Sep 2026 14:31:20 GMT https://vulnogram.org/CVE-2026-87985 https://vulnogram.org/CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary co… Critical Network Exploitable Fri, 11 Sep 2026 14:26:53 GMT https://vulnogram.org/CVE-2026-87984 https://vulnogram.org/CVE-2026-87984 An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks,… Critical Network Exploitable Fri, 11 Sep 2026 14:24:58 GMT https://vulnogram.org/CVE-2026-87983 https://vulnogram.org/CVE-2026-87983 An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validat… Critical Network Exploitable Fri, 11 Sep 2026 14:22:46 GMT https://vulnogram.org/CVE-2026-79721 https://vulnogram.org/CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project. High Tue, 08 Sep 2026 18:10:27 GMT https://vulnogram.org/CVE-2026-79720 https://vulnogram.org/CVE-2026-79720 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. Medium Thu, 27 Aug 2026 16:40:09 GMT https://vulnogram.org/CVE-2026-79719 https://vulnogram.org/CVE-2026-79719 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. Medium Thu, 27 Aug 2026 16:39:10 GMT https://vulnogram.org/CVE-2026-79718 https://vulnogram.org/CVE-2026-79718 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. Medium Thu, 27 Aug 2026 16:37:25 GMT https://vulnogram.org/CVE-2026-45833 https://vulnogram.org/CVE-2026-45833 A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/ten… Critical Fri, 12 Jun 2026 15:16:33 GMT https://vulnogram.org/CVE-2026-45832 https://vulnogram.org/CVE-2026-45832 All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints. High Fri, 12 Jun 2026 15:11:46 GMT https://vulnogram.org/CVE-2026-45831 https://vulnogram.org/CVE-2026-45831 The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to a… High Fri, 12 Jun 2026 15:03:58 GMT https://vulnogram.org/CVE-2026-8828 https://vulnogram.org/CVE-2026-8828 A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to. High Fri, 12 Jun 2026 14:50:32 GMT https://vulnogram.org/CVE-2026-45830 https://vulnogram.org/CVE-2026-45830 A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to. High Fri, 12 Jun 2026 14:46:54 GMT https://vulnogram.org/CVE-2026-45829 https://vulnogram.org/CVE-2026-45829 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to tr… Critical Network Exploitable Mon, 18 May 2026 15:59:22 GMT https://vulnogram.org/CVE-2026-3071 https://vulnogram.org/CVE-2026-3071 Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model. High Thu, 26 Feb 2026 14:56:39 GMT https://vulnogram.org/CVE-2025-62354 https://vulnogram.org/CVE-2025-62354 Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. Critical Network Exploitable Wed, 26 Nov 2025 15:40:24 GMT https://vulnogram.org/CVE-2025-62356 https://vulnogram.org/CVE-2025-62356 A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect pr… High Network Exploitable Fri, 17 Oct 2025 15:36:12 GMT https://vulnogram.org/CVE-2025-62353 https://vulnogram.org/CVE-2025-62353 A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indire… Critical Network Exploitable Fri, 17 Oct 2025 15:27:59 GMT https://vulnogram.org/CVE-2025-49655 https://vulnogram.org/CVE-2025-49655 Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end us… Critical Network Exploitable Fri, 17 Oct 2025 15:20:27 GMT https://vulnogram.org/CVE-2025-49653 https://vulnogram.org/CVE-2025-49653 Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. High Mon, 09 Jun 2025 17:27:00 GMT https://vulnogram.org/CVE-2025-49652 https://vulnogram.org/CVE-2025-49652 Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled. Critical Network Exploitable Mon, 09 Jun 2025 17:26:20 GMT https://vulnogram.org/CVE-2025-49651 https://vulnogram.org/CVE-2025-49651 Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI. High Network Exploitable Mon, 09 Jun 2025 17:25:11 GMT https://vulnogram.org/CVE-2024-45858 https://vulnogram.org/CVE-2024-45858 An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the cod… High Wed, 18 Sep 2024 15:02:17 GMT https://vulnogram.org/CVE-2024-45856 https://vulnogram.org/CVE-2024-45856 A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code with… Critical Thu, 12 Sep 2024 13:05:01 GMT https://vulnogram.org/CVE-2024-45855 https://vulnogram.org/CVE-2024-45855 Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it. High Thu, 12 Sep 2024 13:04:13 GMT https://vulnogram.org/CVE-2024-45854 https://vulnogram.org/CVE-2024-45854 Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it. High Thu, 12 Sep 2024 13:03:30 GMT https://vulnogram.org/CVE-2024-45853 https://vulnogram.org/CVE-2024-45853 Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction. High Thu, 12 Sep 2024 13:03:02 GMT https://vulnogram.org/CVE-2024-45852 https://vulnogram.org/CVE-2024-45852 Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with. High Thu, 12 Sep 2024 13:02:29 GMT https://vulnogram.org/CVE-2024-45851 https://vulnogram.org/CVE-2024-45851 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query c… High Thu, 12 Sep 2024 13:01:02 GMT https://vulnogram.org/CVE-2024-45850 https://vulnogram.org/CVE-2024-45850 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query c… High Thu, 12 Sep 2024 13:00:18 GMT https://vulnogram.org/CVE-2024-45849 https://vulnogram.org/CVE-2024-45849 An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query c… High Thu, 12 Sep 2024 12:59:25 GMT https://vulnogram.org/CVE-2024-45848 https://vulnogram.org/CVE-2024-45848 An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a dat… High Thu, 12 Sep 2024 12:58:32 GMT https://vulnogram.org/CVE-2024-45847 https://vulnogram.org/CVE-2024-45847 An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a… High Thu, 12 Sep 2024 12:57:42 GMT https://vulnogram.org/CVE-2024-45846 https://vulnogram.org/CVE-2024-45846 An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run agains… High Thu, 12 Sep 2024 12:56:48 GMT https://vulnogram.org/CVE-2024-45857 https://vulnogram.org/CVE-2024-45857 Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded. High Thu, 12 Sep 2024 12:53:43 GMT https://vulnogram.org/CVE-2024-27321 https://vulnogram.org/CVE-2024-27321 An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a… High Thu, 12 Sep 2024 12:50:47 GMT https://vulnogram.org/CVE-2024-27320 https://vulnogram.org/CVE-2024-27320 An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously cra… High Thu, 12 Sep 2024 12:49:43 GMT https://vulnogram.org/CVE-2024-37066 https://vulnogram.org/CVE-2024-37066 A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process. Medium Fri, 19 Jul 2024 12:05:11 GMT https://vulnogram.org/CVE-2024-37065 https://vulnogram.org/CVE-2024-37065 Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded. High Tue, 04 Jun 2024 12:03:19 GMT https://vulnogram.org/CVE-2024-37064 https://vulnogram.org/CVE-2024-37064 Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded. High Tue, 04 Jun 2024 12:03:07 GMT https://vulnogram.org/CVE-2024-37063 https://vulnogram.org/CVE-2024-37063 A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser. High Tue, 04 Jun 2024 12:02:53 GMT https://vulnogram.org/CVE-2024-37062 https://vulnogram.org/CVE-2024-37062 Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded. High Tue, 04 Jun 2024 12:02:37 GMT https://vulnogram.org/CVE-2024-37061 https://vulnogram.org/CVE-2024-37061 Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run. High Network Exploitable Tue, 04 Jun 2024 12:02:23 GMT https://vulnogram.org/CVE-2024-37060 https://vulnogram.org/CVE-2024-37060 Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. High Network Exploitable Tue, 04 Jun 2024 12:02:12 GMT https://vulnogram.org/CVE-2024-37059 https://vulnogram.org/CVE-2024-37059 Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with. High Network Exploitable Tue, 04 Jun 2024 12:01:58 GMT https://vulnogram.org/CVE-2024-37058 https://vulnogram.org/CVE-2024-37058 Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with. High Network Exploitable Tue, 04 Jun 2024 12:01:43 GMT https://vulnogram.org/CVE-2024-37057 https://vulnogram.org/CVE-2024-37057 Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with. High Network Exploitable Tue, 04 Jun 2024 12:01:28 GMT https://vulnogram.org/CVE-2024-37056 https://vulnogram.org/CVE-2024-37056 Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with. High Network Exploitable Tue, 04 Jun 2024 12:01:09 GMT